Last Updated: 10/19/2026

CMMC compliance means meeting the Cybersecurity Maturity Model Certification level a Department of War (DoW, formerly DoD) contract requires. There are three levels:

• Level 1: 15 basic safeguards for Federal Contract Information (FCI).
• Level 2: the 110 requirements of NIST SP 800-171 for Controlled Unclassified Information (CUI).
• Level 3: 24 more requirements from NIST SP 800-172.

As of October 2026, Phase 1 self-assessments are in force, and the Phase 2 third-party assessment requirement is suspended pending a DoW review.

Current status — updated October 8, 2026. On July 13, 2026, the Department of War suspended CMMC Phase 2, which would have required C3PAO certification for many Level 2 contracts starting November 10, 2026. Later phases are suspended too. Phase 1 remains in force: Level 1 and Level 2 self-assessments, SPRS affirmations, and DFARS 252.204-7012 obligations. A CMMC Reform Task Force finished its 60-day review in September 2026, and its report has not been published. We will update this page when DoW announces next steps.

What is CMMC?

CMMC is the Department of War’s program for verifying that contractors protect the federal information they handle. It is codified in 32 CFR Part 170, effective December 16, 2024. It enters contracts through the DFARS clause 252.204-7021.

CMMC does not create a new security standard. It checks implementation of standards contractors already owe:

• FAR 52.204-21 for FCI
• NIST SP 800-171 for CUI

What CMMC adds is verification. Depending on the level, that means a signed self-assessment, an independent assessment by an authorized third party, or a government assessment.

You will still see “CMMC 2.0.” That is the name DoD gave the streamlined three-level model announced in November 2021, which replaced the original five-level version. The current program is simply “CMMC.” For a deeper introduction, see what CMMC is and how it works.

Who runs CMMC

• DoW Chief Information Officer: owns the program and its policy.
• The Cyber AB: accredits Certified Third-Party Assessment Organizations (C3PAOs) and certifies individual assessors.
• DCMA’s Defense Industrial Base Cybersecurity Assessment Center (DIBCAC): performs Level 3 assessments and assesses C3PAOs.
• Supplier Performance Risk System (SPRS): where contractors post assessment results and affirmations.

Who needs CMMC compliance?

Any contractor or subcontractor that processes, stores, or transmits FCI or CUI on a DoW contract that includes the CMMC clause needs the level that contract specifies. Prime contractors must flow the requirement down to subcontractors that handle the same information. Contracts solely for commercially available off-the-shelf (COTS) items are exempt.

The two kinds of data drive everything:

• FCI is information provided by or generated for the government under a contract and not intended for public release. FCI alone triggers Level 1.
• CUI is information the government requires to be safeguarded under law, regulation, or policy, but that is not classified. The NARA CUI Registry lists every category. Examples include export-controlled technical data and controlled technical information. CUI triggers Level 2 or Level 3.

Your vendors can be in scope too. Under 32 CFR 170, an External Service Provider (ESP) that handles your CUI or your Security Protection Data becomes part of your assessment. An MSP running your firewall is a common example. Cloud providers that store CUI must meet FedRAMP Moderate or equivalent requirements under DFARS 252.204-7012.

People who handle CUI also need training. Awareness and Training is one of the 14 requirement families in NIST SP 800-171. For a scoping walkthrough, see who needs CMMC.

CMMC levels and requirements

The level is set by the contracting officer based on the information involved, not chosen by the contractor. Here is how the three CMMC levels compare under 32 CFR 170:

CMMC Level 2 is pinned to NIST SP 800-171 Revision 2, even though NIST published Revision 3 in May 2024. Build to Rev 2 for CMMC purposes until DoW says otherwise.

The full control lists are on the CMMC requirements page.

What a POA&M is, and what it is not

A Plan of Action and Milestones (POA&M) lists requirements you have not met yet and how you will close them. At Level 2, CMMC allows a temporary Conditional status if your score is at least 88 of 110 and the open items are on the allowed list. You then have 180 days to close them.

Some high-value requirements can never sit on a POA&M. Level 1 allows no POA&M at all.

Your SPRS score

Separate from CMMC, DFARS 252.204-7019 and 252.204-7020 already require contractors with CUI to post a NIST SP 800-171 assessment score in SPRS. The DoD Assessment Methodology produces scores from -203 to 110. Contracting officers can check that score before award, so an outdated or inflated score is a real exposure.

The CMMC rollout and the 2026 Phase 2 suspension

The rule that put CMMC into contracts took effect on November 10, 2025. It set four phases, each adding requirements one year apart:

On July 13, 2026, DoW announced the immediate suspension of Phase 2 and all later milestones. It also stood up a CMMC Reform Task Force for a 60-day review. DoW cited compliance costs and barriers for small and mid-sized businesses (DoW release).

The review window closed in September 2026. The Task Force report has not been made public.

What still applies to you today

• Phase 1 CMMC requirements. Applicable contracts still require Level 1 or Level 2 self-assessments and annual affirmations in SPRS.
• DFARS 252.204-7012. You must still implement NIST SP 800-171 and report cyber incidents to DoD within 72 hours through DIBNet.
• DFARS 252.204-7019 and 7020. A current SPRS score is still required.
• Legal accountability. Self-assessments and affirmations are signed by a senior official. Federal contractors that misrepresent cybersecurity compliance have faced False Claims Act liability.

The suspension paused when third-party verification becomes mandatory. It did not change what you have to protect or how.

What to watch

• The Reform Task Force report and any DoW decision that follows.
• Any change to 32 CFR Part 170 or the DFARS CMMC rule.
• Final action on the CMMC grant program proposed in the Senate FY2027 NDAA. It is not law yet.

Track every change on our CMMC updates page.

What does CMMC compliance cost?

Cost depends mostly on the level, how much of your environment handles CUI, and how much of NIST SP 800-171 you already have in place. In its final program rule, DoD estimated a Level 2 C3PAO certification at a little over $100,000 for a small business. That figure covers the assessment-related costs. It excludes the cost of implementing the controls themselves (Federal News Network).

The biggest drivers are usually:

• Scope. A well-designed enclave that isolates CUI can cost far less than bringing an entire enterprise up to Level 2.
• Remediation. Multifactor authentication, FIPS-validated encryption, logging, and documentation gaps are common big-ticket items.
• Cloud platform. CUI in the cloud must sit with a FedRAMP Moderate (or equivalent) provider.
• Internal time. Writing a System Security Plan (SSP), collecting evidence, and maintaining both takes ongoing staff hours.

For a breakdown by level and a realistic timeline, see CMMC cost and timeline.

How to prepare for CMMC

The same preparation applies whether you self-assess or bring in a C3PAO. That makes it the safe work to do while the program is under review.

1. Confirm what you handle. Find which contracts carry FCI or CUI and which DFARS and FAR clauses they include.
2. Define your scope. Map where FCI and CUI flow. Classify your assets, and identify the ESPs and cloud services that touch that data.
3. Run a gap assessment. Score yourself honestly against every applicable requirement and assessment objective.
4. Document. Write or update your SSP and build a POA&M for the gaps.
5. Remediate. Close the gaps, starting with requirements that cannot be placed on a POA&M.
6. Report. Post your SPRS score, and have the senior official sign the affirmation.
7. Decide on independent validation. A C3PAO assessment is voluntary for most contracts right now. Some primes still ask suppliers for one.

The detailed version is on how to prepare for CMMC. Before you start, read the most common CMMC mistakes.

Getting assessed: C3PAOs and assessor independence

Only a C3PAO authorized by the Cyber AB can perform an assessment that results in a CMMC Level 2 certification. Authorized C3PAOs are listed on the Cyber AB Marketplace. The C3PAO uploads results to DoW’s CMMC eMASS system. A final certification is valid for three years, as long as annual affirmations continue.

Independence is built into the program. A C3PAO cannot assess an organization it has helped prepare for that assessment. That is why preparation support and the formal assessment should come from different engagements, and often different firms.

For what to look for in an assessor, see choosing a CMMC provider.

Staying compliant after assessment

CMMC is not a one-time event. To keep your status you need to:

• Affirm compliance in SPRS every year.
• Keep your SSP current as systems change.
• Report cyber incidents within 72 hours under DFARS 252.204-7012.
• Reassess every three years, or every year at Level 1.

If your environment changes significantly, your assessment scope may no longer be accurate. See maintaining CMMC compliance.

Explore the CMMC resource hub

• Start here: What is CMMC? · Why CMMC matters · Who needs it
• Requirements and process: Requirements · How it works · How to prepare · Cost and timeline
• Avoid problems: Common mistakes · Myths · Red flags · Audit findings
• Compare and choose: CMMC vs. other frameworks · By segment · Choosing a provider · Tools
• Reference: Official guidance · Updates · Glossary · FAQ · Maintaining compliance

Work with RSI Security

RSI Security is a Cyber AB-authorized C3PAO that performs independent CMMC Level 2 assessments. Organizations at a different stage can work with RSI Security on CMMC readiness through a separate advisory engagement. To protect assessor independence, RSI Security does not assess any organization it has advised on CMMC.

Schedule a CMMC Level 2 assessment · Talk to an advisor about readiness

Frequently asked questions about CMMC compliance